6 ms·

As I understand it, signifiers included command and control servers known to be under Russian state control. So, yes, someone would need to have piggybacked on

As I understand it, signifiers included command and control servers known to be under Russian state control. So, yes, someone would need to have piggybacked on Russian state controlled servers. > Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public Do you work in this field? I've basically only seen lay people suggest this. > That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on. Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.

rendall 5y ago
> As I understand it, signifiers included command and control servers known to be under Russian state control. If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1]. > Do you work in this field? I've basically only seen lay people suggest this. I have seen journalists claim that only lay people suggest this. To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/ https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac... [1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/ https://www.wordfence.com/blog/2017/01/election-hack-faq/ An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons: - A hacked IP can be used by one attacker and then be compromised by a different attacker later on to also launch attacks. - IP addresses change ownership from time to time. A Linode IP may be hacked by Russia and used to launch attacks. Then it may be shut down by Linode, change ownership and the new owner’s site can get hacked. Then that IP address is attacking once again, but the attacker is someone else. - IP addresses are also dynamic if they belong to an internet service provider (ISP). Some of the IP’s in the Grizzly Steppe report do belong to ISP’s. For example we can see IP’s belonging to Yota.ru, a Russian internet service provider. The hostnames are ‘wimax-client.yota.ru’ which suggests that they are wifi customers. These IP’s are probably dynamic and regularly change hands. They may be used by one attacker today and a different attacker tomorrow.
- joshuamorton 5y ago
  All of your articles are from 2016 and 2017, meaning they predate the indictments and muller report. Why do you cite older and less extensive reporting as though it debunks more recent and more thorough investigation? > Furthermore, IP addresses change constantly Yes, and if this was the only evidence, you'd maybe have a point. But, the collection of evidence is: - a russian-state associated IP was used to - deploy software developed by the Russian government - to steal data that would be beneficial to Russia if published - and was ultimately published via channels known to be associated with Russia (I'm not talking strictly WikiLeaks here, but also how they got the data) For each of these bullet points, there are multiple pieces of supporting data. Your alternative explanation is what, exactly? A random ukranian group hacking for the lulz successfully stole this info and either did it so well that the us thought it was actually Russia, or the us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get. I apply Occam's razor. What's your excuse? Keep in mind, I can apply exactly your logic and say that appearing amateurish is good operational practice for a state actor as it will make it more likey for people to claim that the attacker wasn't a state actor. That's the problem with unfalsifiable claims like yours, I can simply invent a better conspiracy, so to speak.
  - rendall 5y ago
    > Why do you cite older and less extensive reporting as though it debunks more recent and more thorough investigation? Not an argument or a refutation. A fallacy, in point of fact. Its age has nothing to do with the correctness of its argument. Have you not read any of the comments above? All of these "more recent and thorough reports" - and again, here, as to which specific reports you're being as vague as the "reports" themselves - are obfuscating, designed to confuse and redirect, at the end of which is always "trust us, here are some other trustworthy reports that say the same thing". By contrast, the word fence report goes through specific allegations and adresses them point by point. Clear, simple, straightforward. In all of the reports demonstrating that Russians hack the DNC, not one is as clear and straightforward, because it never can be. Your alternative explanation is what, exactly? You haven't really refuted anything here, and your reference to Occams Razor should come only after clear logical steps from evidence to conclusion, which you do not have. I don't know who did it. Which is the point. No one does, and no one can know, given the evidence presented so far. I can tell you this, though: politically, the content of the emails themselves were deeply embarrassing to the DNC. Collusion with the media, including the Washington Post and the New York Times, to kneecap Sander's campaign; Donna Brazile passing debate questions to Clinton; Clinton's strategy to promote Trump as the easy win, etc. Now, however, any time anyone discusses the content of the emails, true believers such as yourself will interrupt to talk about how Trump won only because of Russians. It was such a stupidly transparent strategy I was stunned it actually grew legs and walked. Skeptical, but open, I eagerly awaited the evidence which never materialized, sadly. ...us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get. Here you kind of rhetorically descend into incoherence. I get it. You don't want to steel-man alternative ideas, because "Russians" is what you have been told and "Russians" is what you believe. But almost any other explanation is as plausible as Russians.

rendall 5y ago

> As I understand it, signifiers included command and control servers known to be under Russian state control. If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1]. > Do you work in this field? I've basically only seen lay people suggest this. I have seen journalists claim that only lay people suggest this. To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/ https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac... [1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/ https://www.wordfence.com/blog/2017/01/election-hack-faq/ An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons: - A hacked IP can be used by one attacker and then be compromised by a different attacker later on to also launch attacks. - IP addresses change ownership from time to time. A Linode IP may be hacked by Russia and used to launch attacks. Then it may be shut down by Linode, change ownership and the new owner’s site can get hacked. Then that IP address is attacking once again, but the attacker is someone else. - IP addresses are also dynamic if they belong to an internet service provider (ISP). Some of the IP’s in the Grizzly Steppe report do belong to ISP’s. For example we can see IP’s belonging to Yota.ru, a Russian internet service provider. The hostnames are ‘wimax-client.yota.ru’ which suggests that they are wifi customers. These IP’s are probably dynamic and regularly change hands. They may be used by one attacker today and a different attacker tomorrow.

joshuamorton 5y ago
All of your articles are from 2016 and 2017, meaning they predate the indictments and muller report. Why do you cite older and less extensive reporting as though it debunks more recent and more thorough investigation? > Furthermore, IP addresses change constantly Yes, and if this was the only evidence, you'd maybe have a point. But, the collection of evidence is: - a russian-state associated IP was used to - deploy software developed by the Russian government - to steal data that would be beneficial to Russia if published - and was ultimately published via channels known to be associated with Russia (I'm not talking strictly WikiLeaks here, but also how they got the data) For each of these bullet points, there are multiple pieces of supporting data. Your alternative explanation is what, exactly? A random ukranian group hacking for the lulz successfully stole this info and either did it so well that the us thought it was actually Russia, or the us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get. I apply Occam's razor. What's your excuse? Keep in mind, I can apply exactly your logic and say that appearing amateurish is good operational practice for a state actor as it will make it more likey for people to claim that the attacker wasn't a state actor. That's the problem with unfalsifiable claims like yours, I can simply invent a better conspiracy, so to speak.
- rendall 5y ago
  > Why do you cite older and less extensive reporting as though it debunks more recent and more thorough investigation? Not an argument or a refutation. A fallacy, in point of fact. Its age has nothing to do with the correctness of its argument. Have you not read any of the comments above? All of these "more recent and thorough reports" - and again, here, as to which specific reports you're being as vague as the "reports" themselves - are obfuscating, designed to confuse and redirect, at the end of which is always "trust us, here are some other trustworthy reports that say the same thing". By contrast, the word fence report goes through specific allegations and adresses them point by point. Clear, simple, straightforward. In all of the reports demonstrating that Russians hack the DNC, not one is as clear and straightforward, because it never can be. Your alternative explanation is what, exactly? You haven't really refuted anything here, and your reference to Occams Razor should come only after clear logical steps from evidence to conclusion, which you do not have. I don't know who did it. Which is the point. No one does, and no one can know, given the evidence presented so far. I can tell you this, though: politically, the content of the emails themselves were deeply embarrassing to the DNC. Collusion with the media, including the Washington Post and the New York Times, to kneecap Sander's campaign; Donna Brazile passing debate questions to Clinton; Clinton's strategy to promote Trump as the easy win, etc. Now, however, any time anyone discusses the content of the emails, true believers such as yourself will interrupt to talk about how Trump won only because of Russians. It was such a stupidly transparent strategy I was stunned it actually grew legs and walked. Skeptical, but open, I eagerly awaited the evidence which never materialized, sadly. ...us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get. Here you kind of rhetorically descend into incoherence. I get it. You don't want to steel-man alternative ideas, because "Russians" is what you have been told and "Russians" is what you believe. But almost any other explanation is as plausible as Russians.